A loophole in WhatsApp for Android lets someone see private photos on your device without the device being unlocked, which obviously isn’t supposed to happen.
First spotted by @VBarraquito on Twitter/X and further confirmed by “Mobile Hacker” and NotebookCheck, a very straightforward flaw exists within WhatsApp for Android that allows someone to access a user’s private photos before the device is unlocked.
This works by first having a WhatsApp call pop up and be answered – this doesn’t require the phone to be unlocked, just like a standard phone call – at which point the user can tap a button to use filters and effects on their video feed, including Meta’s AI to edit a photo – you can see where this is going. Instead of preventing access to photos, the preview is shown clearly before the phone ever asks to be unlocked with a PIN or biometrics.
This isn’t universal, though. NotebookCheck found that a Galaxy device does force the lockscreen to be unlocked before reaching this step, while Pixel and Oppo devices both allowed the full bypass. The loophole doesn’t exist on iPhone, where WhatsApp is forced to use the native iOS calling UI.
The good news: this doesn’t seem to bypass the lockscreen fully, as accessing any other part of the device is still blocked. There’s also not much that can be done with the photos beyond physically seeing them – though a malicious party could use this to take photos of those images with a second device.
WhatsApp should be able to patch this with an update, but no such update has been announced at this time. The loophole has been reported to both WhatsApp and Google.
In the meantime, a temporary workaround is to set WhatsApp’s photo/video access to “limited” in Android’s permissions, which breaks the loophole.
More on WhatsApp:
- WhatsApp two-step verification codes are ditching six-digit PINs for full passwords
- WhatsApp updates group chats with new features including ‘@all’ tag
- Android Auto rolling out upgraded WhatsApp support
Follow Ben: Twitter/X, Threads, Bluesky, and Instagram
You’re reading 9to5Google — experts who break news about Google and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Google on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel
